CVE-2026-64437

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ksmbd module of the Linux kernel. The problem occurs when an authenticated SMB client triggers an SMB2 CLOSE followed by an SMB2 CANCEL. Specifically, when SMB2 CLOSE is called on a locking handle, the deferred work state is set to KSMBD WORK CLOSED, and the smb2 lock() worker frees the file lock but fails to call release async work(). This leaves a live cancel fn (specifically smb2 remove blocked lock()) pointing to the freed file lock. A subsequent SMB2 CANCEL request for the same AsyncId can then trigger the cancel fn again, leading to a use-after-free in the locks delete block() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.